SUSE-SU-2022:4633-1

Опубликовано: 28 дек. 2022

Источник: suse-cvrf

Описание

Security update for curl

This update for curl fixes the following issues:

CVE-2022-43552: HTTP Proxy deny use-after-free (bsc#1206309).

Список пакетов

Container bci/bci-init:15.3

libcurl4-7.66.0-150200.4.45.1

Container bci/node:12

libcurl4-7.66.0-150200.4.45.1

Container bci/python:3

curl-7.66.0-150200.4.45.1

libcurl4-7.66.0-150200.4.45.1

Container ses/7.1/ceph/grafana:latest

libcurl4-7.66.0-150200.4.45.1

Container ses/7.1/ceph/haproxy:latest

libcurl4-7.66.0-150200.4.45.1

Container ses/7.1/ceph/keepalived:latest

libcurl4-7.66.0-150200.4.45.1

Container ses/7.1/ceph/prometheus-alertmanager:latest

libcurl4-7.66.0-150200.4.45.1

Container ses/7.1/ceph/prometheus-node-exporter:latest

libcurl4-7.66.0-150200.4.45.1

Container ses/7.1/ceph/prometheus-server:latest

libcurl4-7.66.0-150200.4.45.1

Container ses/7.1/ceph/prometheus-snmp_notifier:latest

libcurl4-7.66.0-150200.4.45.1

Container ses/7.1/cephcsi/cephcsi:latest

libcurl4-7.66.0-150200.4.45.1

Container ses/7.1/cephcsi/csi-attacher:v4.1.0

libcurl4-7.66.0-150200.4.45.1

Container ses/7.1/cephcsi/csi-node-driver-registrar:v2.7.0

libcurl4-7.66.0-150200.4.45.1

Container ses/7.1/cephcsi/csi-provisioner:v3.4.0

libcurl4-7.66.0-150200.4.45.1

Container ses/7.1/cephcsi/csi-resizer:v1.7.0

libcurl4-7.66.0-150200.4.45.1

Container ses/7.1/cephcsi/csi-snapshotter:v6.2.1

libcurl4-7.66.0-150200.4.45.1

Container ses/7.1/rook/ceph:latest

libcurl4-7.66.0-150200.4.45.1

Container suse/ltss/sle15.3/bci-base:latest

curl-7.66.0-150200.4.45.1

libcurl4-7.66.0-150200.4.45.1

Container suse/sle-micro-rancher/5.2:latest

curl-7.66.0-150200.4.45.1

libcurl4-7.66.0-150200.4.45.1

Container suse/sle-micro/5.1/toolbox:latest

curl-7.66.0-150200.4.45.1

libcurl4-7.66.0-150200.4.45.1

Container suse/sle-micro/5.2/toolbox:latest

curl-7.66.0-150200.4.45.1

libcurl4-7.66.0-150200.4.45.1

Container suse/sle15:15.2

libcurl4-7.66.0-150200.4.45.1

Container suse/sle15:15.3

curl-7.66.0-150200.4.45.1

libcurl4-7.66.0-150200.4.45.1

Image SLES15-SP2-BYOS-Azure

curl-7.66.0-150200.4.45.1

libcurl4-7.66.0-150200.4.45.1

Image SLES15-SP2-HPC-BYOS-Azure

curl-7.66.0-150200.4.45.1

libcurl4-7.66.0-150200.4.45.1

Image SLES15-SP2-SAP-Azure

curl-7.66.0-150200.4.45.1

libcurl4-7.66.0-150200.4.45.1

Image SLES15-SP2-SAP-Azure-LI-BYOS-Production

curl-7.66.0-150200.4.45.1

libcurl4-7.66.0-150200.4.45.1

Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production

curl-7.66.0-150200.4.45.1

libcurl4-7.66.0-150200.4.45.1

Image SLES15-SP2-SAP-BYOS-Azure

curl-7.66.0-150200.4.45.1

libcurl4-7.66.0-150200.4.45.1

Image SLES15-SP2-SAP-BYOS-EC2-HVM

curl-7.66.0-150200.4.45.1

libcurl4-7.66.0-150200.4.45.1

Image SLES15-SP2-SAP-BYOS-GCE

curl-7.66.0-150200.4.45.1

libcurl4-7.66.0-150200.4.45.1

Image SLES15-SP2-SAP-EC2-HVM

curl-7.66.0-150200.4.45.1

libcurl4-7.66.0-150200.4.45.1

Image SLES15-SP2-SAP-GCE

curl-7.66.0-150200.4.45.1

libcurl4-7.66.0-150200.4.45.1

Image SLES15-SP3-BYOS-Azure

curl-7.66.0-150200.4.45.1

libcurl4-7.66.0-150200.4.45.1

Image SLES15-SP3-BYOS-EC2-HVM

curl-7.66.0-150200.4.45.1

libcurl4-7.66.0-150200.4.45.1

Image SLES15-SP3-BYOS-GCE

curl-7.66.0-150200.4.45.1

libcurl4-7.66.0-150200.4.45.1

Image SLES15-SP3-CHOST-BYOS-Aliyun

curl-7.66.0-150200.4.45.1

libcurl4-7.66.0-150200.4.45.1

Image SLES15-SP3-CHOST-BYOS-Azure

curl-7.66.0-150200.4.45.1

libcurl4-7.66.0-150200.4.45.1

Image SLES15-SP3-CHOST-BYOS-EC2

curl-7.66.0-150200.4.45.1

libcurl4-7.66.0-150200.4.45.1

Image SLES15-SP3-CHOST-BYOS-GCE

curl-7.66.0-150200.4.45.1

libcurl4-7.66.0-150200.4.45.1

Image SLES15-SP3-CHOST-BYOS-SAP-CCloud

curl-7.66.0-150200.4.45.1

libcurl4-7.66.0-150200.4.45.1

Image SLES15-SP3-HPC-BYOS-Azure

curl-7.66.0-150200.4.45.1

libcurl4-7.66.0-150200.4.45.1

Image SLES15-SP3-HPC-BYOS-EC2-HVM

curl-7.66.0-150200.4.45.1

libcurl4-7.66.0-150200.4.45.1

Image SLES15-SP3-HPC-BYOS-GCE

curl-7.66.0-150200.4.45.1

libcurl4-7.66.0-150200.4.45.1

Image SLES15-SP3-Manager-4-2-Proxy-BYOS-Azure

curl-7.66.0-150200.4.45.1

libcurl4-7.66.0-150200.4.45.1

Image SLES15-SP3-Manager-4-2-Proxy-BYOS-EC2-HVM

curl-7.66.0-150200.4.45.1

libcurl4-7.66.0-150200.4.45.1

Image SLES15-SP3-Manager-4-2-Proxy-BYOS-GCE

curl-7.66.0-150200.4.45.1

libcurl4-7.66.0-150200.4.45.1

Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure

curl-7.66.0-150200.4.45.1

libcurl4-7.66.0-150200.4.45.1

Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM

curl-7.66.0-150200.4.45.1

libcurl4-7.66.0-150200.4.45.1

Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE

curl-7.66.0-150200.4.45.1

libcurl4-7.66.0-150200.4.45.1

Image SLES15-SP3-Micro-5-1-BYOS-Azure

curl-7.66.0-150200.4.45.1

libcurl4-7.66.0-150200.4.45.1

Image SLES15-SP3-Micro-5-1-BYOS-EC2-HVM

curl-7.66.0-150200.4.45.1

libcurl4-7.66.0-150200.4.45.1

Image SLES15-SP3-Micro-5-1-BYOS-GCE

curl-7.66.0-150200.4.45.1

libcurl4-7.66.0-150200.4.45.1

Image SLES15-SP3-Micro-5-2-BYOS-Azure

curl-7.66.0-150200.4.45.1

libcurl4-7.66.0-150200.4.45.1

Image SLES15-SP3-Micro-5-2-BYOS-EC2-HVM

curl-7.66.0-150200.4.45.1

libcurl4-7.66.0-150200.4.45.1

Image SLES15-SP3-Micro-5-2-BYOS-GCE

curl-7.66.0-150200.4.45.1

libcurl4-7.66.0-150200.4.45.1

Image SLES15-SP3-SAP-Azure-LI-BYOS-Production

curl-7.66.0-150200.4.45.1

libcurl4-7.66.0-150200.4.45.1

Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production

curl-7.66.0-150200.4.45.1

libcurl4-7.66.0-150200.4.45.1

Image SLES15-SP3-SAP-BYOS-Azure

curl-7.66.0-150200.4.45.1

libcurl4-7.66.0-150200.4.45.1

Image SLES15-SP3-SAP-BYOS-EC2-HVM

curl-7.66.0-150200.4.45.1

libcurl4-7.66.0-150200.4.45.1

Image SLES15-SP3-SAP-BYOS-GCE

curl-7.66.0-150200.4.45.1

libcurl4-7.66.0-150200.4.45.1

Image SLES15-SP3-SAPCAL-Azure

curl-7.66.0-150200.4.45.1

libcurl-devel-7.66.0-150200.4.45.1

libcurl4-7.66.0-150200.4.45.1

libcurl4-32bit-7.66.0-150200.4.45.1

Image SLES15-SP3-SAPCAL-EC2-HVM

curl-7.66.0-150200.4.45.1

libcurl-devel-7.66.0-150200.4.45.1

libcurl4-7.66.0-150200.4.45.1

libcurl4-32bit-7.66.0-150200.4.45.1

Image SLES15-SP3-SAPCAL-GCE

curl-7.66.0-150200.4.45.1

libcurl-devel-7.66.0-150200.4.45.1

libcurl4-7.66.0-150200.4.45.1

libcurl4-32bit-7.66.0-150200.4.45.1

SUSE Linux Enterprise Micro 5.1

curl-7.66.0-150200.4.45.1

libcurl4-7.66.0-150200.4.45.1

SUSE Linux Enterprise Micro 5.2

curl-7.66.0-150200.4.45.1

libcurl4-7.66.0-150200.4.45.1

SUSE Linux Enterprise Real Time 15 SP3

curl-7.66.0-150200.4.45.1

libcurl-devel-7.66.0-150200.4.45.1

libcurl4-7.66.0-150200.4.45.1

libcurl4-32bit-7.66.0-150200.4.45.1

openSUSE Leap 15.3

curl-7.66.0-150200.4.45.1

libcurl-devel-7.66.0-150200.4.45.1

libcurl-devel-32bit-7.66.0-150200.4.45.1

libcurl4-7.66.0-150200.4.45.1

libcurl4-32bit-7.66.0-150200.4.45.1

openSUSE Leap Micro 5.2

curl-7.66.0-150200.4.45.1

libcurl4-7.66.0-150200.4.45.1

Ссылки

https://www.suse.com/support/update/announcement/2022/suse-su-20224633-1/
Link for SUSE-SU-2022:4633-1
https://lists.suse.com/pipermail/sle-security-updates/2022-December/013355.html
E-Mail link for SUSE-SU-2022:4633-1
https://www.suse.com/support/security/rating/
SUSE Security Ratings
https://bugzilla.suse.com/1206309
SUSE Bug 1206309
https://www.suse.com/security/cve/CVE-2022-43552/
SUSE CVE CVE-2022-43552 page

Описание

A use after free vulnerability exists in curl <7.87.0. Curl can be asked to *tunnel* virtually all protocols it supports through an HTTP proxy. HTTP proxies can (and often do) deny such tunnel operations. When getting denied to tunnel the specific protocols SMB or TELNET, curl would use a heap-allocated struct after it had been freed, in its transfer shutdown code path.

Затронутые продукты

Container bci/bci-init:15.3:libcurl4-7.66.0-150200.4.45.1

Container bci/node:12:libcurl4-7.66.0-150200.4.45.1

Container bci/python:3:curl-7.66.0-150200.4.45.1

Container bci/python:3:libcurl4-7.66.0-150200.4.45.1

Ссылки

https://www.suse.com/security/cve/CVE-2022-43552.html
CVE-2022-43552
https://bugzilla.suse.com/1206309
SUSE Bug 1206309

SUSE-SU-2022:4633-1

Описание

Список пакетов

Container bci/bci-init:15.3

Container bci/node:12

Container bci/python:3

Container ses/7.1/ceph/grafana:latest

Container ses/7.1/ceph/haproxy:latest

Container ses/7.1/ceph/keepalived:latest

Container ses/7.1/ceph/prometheus-alertmanager:latest

Container ses/7.1/ceph/prometheus-node-exporter:latest

Container ses/7.1/ceph/prometheus-server:latest

Container ses/7.1/ceph/prometheus-snmp_notifier:latest

Container ses/7.1/cephcsi/cephcsi:latest

Container ses/7.1/cephcsi/csi-attacher:v4.1.0

Container ses/7.1/cephcsi/csi-node-driver-registrar:v2.7.0

Container ses/7.1/cephcsi/csi-provisioner:v3.4.0

Container ses/7.1/cephcsi/csi-resizer:v1.7.0

Container ses/7.1/cephcsi/csi-snapshotter:v6.2.1

Container ses/7.1/rook/ceph:latest

Container suse/ltss/sle15.3/bci-base:latest

Container suse/sle-micro-rancher/5.2:latest

Container suse/sle-micro/5.1/toolbox:latest

Container suse/sle-micro/5.2/toolbox:latest

Container suse/sle15:15.2

Container suse/sle15:15.3

Image SLES15-SP2-BYOS-Azure

Image SLES15-SP2-HPC-BYOS-Azure

Image SLES15-SP2-SAP-Azure

Image SLES15-SP2-SAP-Azure-LI-BYOS-Production

Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production

Image SLES15-SP2-SAP-BYOS-Azure

Image SLES15-SP2-SAP-BYOS-EC2-HVM

Image SLES15-SP2-SAP-BYOS-GCE

Image SLES15-SP2-SAP-EC2-HVM

Image SLES15-SP2-SAP-GCE

Image SLES15-SP3-BYOS-Azure

Image SLES15-SP3-BYOS-EC2-HVM

Image SLES15-SP3-BYOS-GCE

Image SLES15-SP3-CHOST-BYOS-Aliyun

Image SLES15-SP3-CHOST-BYOS-Azure

Image SLES15-SP3-CHOST-BYOS-EC2

Image SLES15-SP3-CHOST-BYOS-GCE

Image SLES15-SP3-CHOST-BYOS-SAP-CCloud

Image SLES15-SP3-HPC-BYOS-Azure

Image SLES15-SP3-HPC-BYOS-EC2-HVM

Image SLES15-SP3-HPC-BYOS-GCE

Image SLES15-SP3-Manager-4-2-Proxy-BYOS-Azure

Image SLES15-SP3-Manager-4-2-Proxy-BYOS-EC2-HVM

Image SLES15-SP3-Manager-4-2-Proxy-BYOS-GCE

Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure

Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM

Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE

Image SLES15-SP3-Micro-5-1-BYOS-Azure

Image SLES15-SP3-Micro-5-1-BYOS-EC2-HVM

Image SLES15-SP3-Micro-5-1-BYOS-GCE

Image SLES15-SP3-Micro-5-2-BYOS-Azure

Image SLES15-SP3-Micro-5-2-BYOS-EC2-HVM

Image SLES15-SP3-Micro-5-2-BYOS-GCE

Image SLES15-SP3-SAP-Azure-LI-BYOS-Production

Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production

Image SLES15-SP3-SAP-BYOS-Azure

Image SLES15-SP3-SAP-BYOS-EC2-HVM

Image SLES15-SP3-SAP-BYOS-GCE

Image SLES15-SP3-SAPCAL-Azure

Image SLES15-SP3-SAPCAL-EC2-HVM

Image SLES15-SP3-SAPCAL-GCE

SUSE Linux Enterprise Micro 5.1

SUSE Linux Enterprise Micro 5.2

SUSE Linux Enterprise Real Time 15 SP3

openSUSE Leap 15.3

openSUSE Leap Micro 5.2

Ссылки

Уязвимость: CVE-2022-43552

Описание

Затронутые продукты

Ссылки